CVE-2018-0457

Cisco Webex Player WRF Files Denial of Service Vulnerability

A vulnerability in the Cisco Webex Player for Webex Recording Format (WRF) files could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition. An attacker could exploit this vulnerability by sending a user a link or email attachment with a malicious WRF file and persuading the user to open the file in the Cisco Webex Player. A successful exploit could cause the affected player to crash, resulting in a DoS condition. For more information about this vulnerability, see the Details section of this security advisory.

CVSS 3.0 · 5.5 Medium EPSS 1.7% KEV · Not listed

Vendors

Cisco

Products

Webex Meetings Online

CVE-2018-15408

Cisco Webex Network Recording Player and Cisco Webex Player Remote Code Execution Vulnerabilities

A vulnerability in the Cisco Webex Network Recording Player for Microsoft Windows and the Cisco Webex Player for Microsoft Windows could allow an attacker to execute arbitrary code on an affected system. The vulnerability exist because the affected software improperly validates Advanced Recording Format (ARF) and Webex Recording Format (WRF) files. An attacker could exploit this vulnerability by sending a user a malicious ARF or WRF file via a link or an email attachment and persuading the user to open the file by using the affected software. A successful exploit could allow the attacker to execute arbitrary code on the affected system.

CVSS 3.0 · 7.8 High EPSS 2.1% KEV · Not listed

Vendors

Cisco

Products

Webex Business Suite 32 Webex Business Suite 33 Webex Meetings Online and 1 more

CVE-2018-15409

Cisco Webex Network Recording Player and Cisco Webex Player Remote Code Execution Vulnerabilities

A vulnerability in the Cisco Webex Network Recording Player for Microsoft Windows and the Cisco Webex Player for Microsoft Windows could allow an attacker to execute arbitrary code on an affected system. The vulnerability exist because the affected software improperly validates Advanced Recording Format (ARF) and Webex Recording Format (WRF) files. An attacker could exploit this vulnerability by sending a user a malicious ARF or WRF file via a link or an email attachment and persuading the user to open the file by using the affected software. A successful exploit could allow the attacker to execute arbitrary code on the affected system.

CVSS 3.0 · 7.8 High EPSS 1.9% KEV · Not listed

Vendors

Cisco

Products

Webex Business Suite 31 Webex Business Suite 33 Webex Meetings Online and 1 more

CVE-2018-15410

Cisco Webex Network Recording Player and Cisco Webex Player Remote Code Execution Vulnerabilities

A vulnerability in the Cisco Webex Network Recording Player for Microsoft Windows and the Cisco Webex Player for Microsoft Windows could allow an attacker to execute arbitrary code on an affected system. The vulnerability exist because the affected software improperly validates Advanced Recording Format (ARF) and Webex Recording Format (WRF) files. An attacker could exploit this vulnerability by sending a user a malicious ARF or WRF file via a link or an email attachment and persuading the user to open the file by using the affected software. A successful exploit could allow the attacker to execute arbitrary code on the affected system.

CVSS 3.1 · 7.8 High EPSS 2.0% KEV · Not listed

Vendors

Cisco

Products

Webex Business Suite 31 Webex Business Suite 32 Webex Business Suite 33 and 2 more

CVE-2018-15411

Cisco Webex Network Recording Player and Cisco Webex Player Remote Code Execution Vulnerabilities

A vulnerability in the Cisco Webex Network Recording Player for Microsoft Windows and the Cisco Webex Player for Microsoft Windows could allow an attacker to execute arbitrary code on an affected system. The vulnerability exist because the affected software improperly validates Advanced Recording Format (ARF) and Webex Recording Format (WRF) files. An attacker could exploit this vulnerability by sending a user a malicious ARF or WRF file via a link or an email attachment and persuading the user to open the file by using the affected software. A successful exploit could allow the attacker to execute arbitrary code on the affected system.

CVSS 3.1 · 7.8 High EPSS 2.0% KEV · Not listed

Vendors

Cisco

Products

Webex Business Suite 32 Webex Business Suite 33 Webex Meetings Online and 1 more

CVE-2018-15412

Cisco Webex Network Recording Player and Cisco Webex Player Remote Code Execution Vulnerabilities

A vulnerability in the Cisco Webex Network Recording Player for Microsoft Windows and the Cisco Webex Player for Microsoft Windows could allow an attacker to execute arbitrary code on an affected system. The vulnerability exist because the affected software improperly validates Advanced Recording Format (ARF) and Webex Recording Format (WRF) files. An attacker could exploit this vulnerability by sending a user a malicious ARF or WRF file via a link or an email attachment and persuading the user to open the file by using the affected software. A successful exploit could allow the attacker to execute arbitrary code on the affected system.

CVSS 3.0 · 7.8 High EPSS 2.1% KEV · Not listed

Vendors

Cisco

Products

Webex Business Suite 32 Webex Business Suite 33 Webex Meetings Online and 1 more

CVE-2018-15413

Cisco Webex Network Recording Player and Cisco Webex Player Remote Code Execution Vulnerabilities

A vulnerability in the Cisco Webex Network Recording Player for Microsoft Windows and the Cisco Webex Player for Microsoft Windows could allow an attacker to execute arbitrary code on an affected system. The vulnerability exist because the affected software improperly validates Advanced Recording Format (ARF) and Webex Recording Format (WRF) files. An attacker could exploit this vulnerability by sending a user a malicious ARF or WRF file via a link or an email attachment and persuading the user to open the file by using the affected software. A successful exploit could allow the attacker to execute arbitrary code on the affected system.

CVSS 3.0 · 7.8 High EPSS 2.1% KEV · Not listed

Vendors

Cisco

Products

Webex Business Suite 32 Webex Business Suite 33 Webex Meetings Online and 1 more

CVE-2018-15414

Cisco Webex Network Recording Player Remote Code Execution Vulnerabilities

A vulnerability in the Cisco Webex Network Recording Player for Microsoft Windows and the Cisco Webex Player for Microsoft Windows could allow an attacker to execute arbitrary code on an affected system. The vulnerability exist because the affected software improperly validates Advanced Recording Format (ARF) and Webex Recording Format (WRF) files. An attacker could exploit this vulnerability by sending a user a malicious ARF or WRF file via a link or an email attachment and persuading the user to open the file by using the affected software. A successful exploit could allow the attacker to execute arbitrary code on the affected system.

CVSS 3.0 · 7.8 High EPSS 2.1% KEV · Not listed

Vendors

Cisco

Products

Webex Business Suite 32 Webex Business Suite 33 Webex Meetings Online and 1 more

CVE-2018-15415

Cisco Webex Network Recording Player and Cisco Webex Player Remote Code Execution Vulnerabilities

A vulnerability in the Cisco Webex Network Recording Player for Microsoft Windows and the Cisco Webex Player for Microsoft Windows could allow an attacker to execute arbitrary code on an affected system. The vulnerability exist because the affected software improperly validates Advanced Recording Format (ARF) and Webex Recording Format (WRF) files. An attacker could exploit this vulnerability by sending a user a malicious ARF or WRF file via a link or an email attachment and persuading the user to open the file by using the affected software. A successful exploit could allow the attacker to execute arbitrary code on the affected system.

CVSS 3.0 · 7.8 High EPSS 2.1% KEV · Not listed

Vendors

Cisco

Products

Webex Business Suite 32 Webex Business Suite 33 Webex Meetings Online and 1 more

CVE-2018-15416

Cisco Webex Network Recording Player and Cisco Webex Player Remote Code Execution Vulnerabilities

A vulnerability in the Cisco Webex Network Recording Player for Microsoft Windows and the Cisco Webex Player for Microsoft Windows could allow an attacker to execute arbitrary code on an affected system. The vulnerability exist because the affected software improperly validates Advanced Recording Format (ARF) and Webex Recording Format (WRF) files. An attacker could exploit this vulnerability by sending a user a malicious ARF or WRF file via a link or an email attachment and persuading the user to open the file by using the affected software. A successful exploit could allow the attacker to execute arbitrary code on the affected system.

CVSS 3.0 · 7.8 High EPSS 2.1% KEV · Not listed

Vendors

Cisco

Products

Webex Business Suite 32 Webex Business Suite 33 Webex Meetings Online and 1 more

CVE-2018-15417

Cisco Webex Network Recording Player and Cisco Webex Player Remote Code Execution Vulnerabilities

A vulnerability in the Cisco Webex Network Recording Player for Microsoft Windows and the Cisco Webex Player for Microsoft Windows could allow an attacker to execute arbitrary code on an affected system. The vulnerability exist because the affected software improperly validates Advanced Recording Format (ARF) and Webex Recording Format (WRF) files. An attacker could exploit this vulnerability by sending a user a malicious ARF or WRF file via a link or an email attachment and persuading the user to open the file by using the affected software. A successful exploit could allow the attacker to execute arbitrary code on the affected system.

CVSS 3.0 · 7.8 High EPSS 2.1% KEV · Not listed

Vendors

Cisco

Products

Webex Business Suite 32 Webex Business Suite 33 Webex Meetings Online and 1 more

CVE-2018-15418

Cisco Webex Network Recording Player and Cisco Webex Player Remote Code Execution Vulnerabilities

A vulnerability in the Cisco Webex Network Recording Player for Microsoft Windows and the Cisco Webex Player for Microsoft Windows could allow an attacker to execute arbitrary code on an affected system. The vulnerability exist because the affected software improperly validates Advanced Recording Format (ARF) and Webex Recording Format (WRF) files. An attacker could exploit this vulnerability by sending a user a malicious ARF or WRF file via a link or an email attachment and persuading the user to open the file by using the affected software. A successful exploit could allow the attacker to execute arbitrary code on the affected system.

CVSS 3.1 · 7.8 High EPSS 2.0% KEV · Not listed

Vendors

Cisco

Products

Webex Business Suite 31 Webex Business Suite 32 Webex Business Suite 33 and 2 more

CVE-2018-15419

Cisco Webex Network Recording Player and Cisco Webex Player Remote Code Execution Vulnerabilities

A vulnerability in the Cisco Webex Network Recording Player for Microsoft Windows and the Cisco Webex Player for Microsoft Windows could allow an attacker to execute arbitrary code on an affected system. The vulnerability exist because the affected software improperly validates Advanced Recording Format (ARF) and Webex Recording Format (WRF) files. An attacker could exploit this vulnerability by sending a user a malicious ARF or WRF file via a link or an email attachment and persuading the user to open the file by using the affected software. A successful exploit could allow the attacker to execute arbitrary code on the affected system.

CVSS 3.1 · 7.8 High EPSS 2.0% KEV · Not listed

Vendors

Cisco

Products

Webex Business Suite 32 Webex Business Suite 33 Webex Meetings Online and 1 more

CVE-2018-15420

Cisco Webex Network Recording Player and Cisco Webex Player Remote Code Execution Vulnerabilities

A vulnerability in the Cisco Webex Network Recording Player for Microsoft Windows and the Cisco Webex Player for Microsoft Windows could allow an attacker to execute arbitrary code on an affected system. The vulnerability exist because the affected software improperly validates Advanced Recording Format (ARF) and Webex Recording Format (WRF) files. An attacker could exploit this vulnerability by sending a user a malicious ARF or WRF file via a link or an email attachment and persuading the user to open the file by using the affected software. A successful exploit could allow the attacker to execute arbitrary code on the affected system.

CVSS 3.0 · 7.8 High EPSS 2.1% KEV · Not listed

Vendors

Cisco

Products

Webex Business Suite 32 Webex Business Suite 33 Webex Meetings Online and 1 more

CVE-2018-15421

Cisco Webex Network Recording Player Remote Code Execution Vulnerabilities

A vulnerability in the Cisco Webex Network Recording Player for Microsoft Windows and the Cisco Webex Player for Microsoft Windows could allow an attacker to execute arbitrary code on an affected system. The vulnerability exist because the affected software improperly validates Advanced Recording Format (ARF) and Webex Recording Format (WRF) files. An attacker could exploit this vulnerability by sending a user a malicious ARF or WRF file via a link or an email attachment and persuading the user to open the file by using the affected software. A successful exploit could allow the attacker to execute arbitrary code on the affected system.

CVSS 3.1 · 7.8 High EPSS 2.0% KEV · Not listed

Vendors

Cisco

Products

Webex Business Suite 32 Webex Business Suite 33 Webex Meetings Online and 1 more

CVE-2018-15422

Cisco Webex Network Recording Player Remote Code Execution Vulnerabilities

A vulnerability in the Cisco Webex Network Recording Player for Microsoft Windows and the Cisco Webex Player for Microsoft Windows could allow an attacker to execute arbitrary code on an affected system. The vulnerability exist because the affected software improperly validates Advanced Recording Format (ARF) and Webex Recording Format (WRF) files. An attacker could exploit this vulnerability by sending a user a malicious ARF or WRF file via a link or an email attachment and persuading the user to open the file by using the affected software. A successful exploit could allow the attacker to execute arbitrary code on the affected system.

CVSS 3.1 · 7.8 High EPSS 2.0% KEV · Not listed

Vendors

Cisco

Products

Webex Business Suite 32 Webex Business Suite 33 Webex Meetings Online and 1 more

CVE-2018-15431

Cisco Webex Network Recording Player and Cisco Webex Player Remote Code Execution Vulnerabilities

A vulnerability in the Cisco Webex Network Recording Player for Microsoft Windows and the Cisco Webex Player for Microsoft Windows could allow an attacker to execute arbitrary code on an affected system. The vulnerability exist because the affected software improperly validates Advanced Recording Format (ARF) and Webex Recording Format (WRF) files. An attacker could exploit this vulnerability by sending a user a malicious ARF or WRF file via a link or an email attachment and persuading the user to open the file by using the affected software. A successful exploit could allow the attacker to execute arbitrary code on the affected system.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed

Vendors

Cisco

Products

Webex Business Suite 32 Webex Meetings Online Webex Meetings Server

CVE-2018-15436

Cisco Webex Centers Cross-Site Scripting Vulnerability

A vulnerability in the web-based management interface of Cisco Webex Events Center, Cisco Webex Meeting Center, Cisco Webex Support Center, and Cisco Webex Training Center could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based management interface of the affected service. The vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of the affected service. An attacker could exploit this vulnerability by persuading a user of the interface to click a malicious link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information.

CVSS 3.0 · 6.1 Medium EPSS 1.4% KEV · Not listed

Vendors

Cisco

Products

Webex Business Suite 31 Webex Business Suite 32 Webex Business Suite 33 and 1 more

CVE-2018-15442

Cisco Webex Meetings Desktop App Update Service Command Injection Vulnerability

A vulnerability in the update service of Cisco Webex Meetings Desktop App for Windows could allow an authenticated, local attacker to execute arbitrary commands as a privileged user. The vulnerability is due to insufficient validation of user-supplied parameters. An attacker could exploit this vulnerability by invoking the update service command with a crafted argument. An exploit could allow the attacker to run arbitrary commands with SYSTEM user privileges. While the CVSS Attack Vector metric denotes the requirement for an attacker to have local access, administrators should be aware that in Active Directory deployments, the vulnerability could be exploited remotely by leveraging the operating system remote management tools.

CVSS 3.0 · 7.8 High EPSS 16.0% KEV · Not listed

Vendors

Cisco

Products

Webex Meetings Desktop Webex Productivity Tools

CVE-2019-1655

Cisco Webex Meetings Server Cross-Site Scripting Vulnerability

A vulnerability in the web-based management interface of Cisco Webex Meetings Server could allow an unauthenticated, remote attacker to conduct a cross-site scripting (XSS) attack against a user of the web-based interface of the affected software. The vulnerability is due to insufficient validation of user-supplied input by the affected software. An attacker could exploit this vulnerability by persuading a user of the interface to click a maliciously crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information.

CVSS 3.0 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Cisco

Products

Webex Meetings Server